Summary
scripts/fetch-pjproject.sh defaults to PJ_VERSION=2.16, and the CI pjsip-shim-cffi job builds the shim against pjproject 2.16. pjproject 2.17 was released 2026-04-22.
Why
The 2.17 release includes multiple security fixes — buffer overflows and use-after-free across ICE, H.264 packetization, DNS parsing, and codec handling — plus async client authentication and deadlock fixes. Since the shim compiles the pjproject C sources under the pjproject-cffi feature, these fixes matter whenever that feature is enabled.
Proposed change
- Default
PJ_VERSION to 2.17 in scripts/fetch-pjproject.sh (the PJ_URL template already interpolates the version).
- Confirm the shim's
build.rs auto-detection path crates/pjsip-shim/vendor/pjproject-2.17 still resolves (it derives from PJ_VERSION, so it should).
- Let the existing
pjsip-shim-cffi CI job validate the build against 2.17.
Notes
Vendored sources are git-ignored (GPL-2.0), so this is a one-line default bump plus a CI re-run to confirm the shim still compiles and links against the 2.17 headers/sources. Low risk; no Rust code changes expected.
Found during deep-QA upstream-currency review (FINDINGS.md, task #5).
Summary
scripts/fetch-pjproject.shdefaults toPJ_VERSION=2.16, and the CIpjsip-shim-cffijob builds the shim against pjproject 2.16. pjproject 2.17 was released 2026-04-22.Why
The 2.17 release includes multiple security fixes — buffer overflows and use-after-free across ICE, H.264 packetization, DNS parsing, and codec handling — plus async client authentication and deadlock fixes. Since the shim compiles the pjproject C sources under the
pjproject-cffifeature, these fixes matter whenever that feature is enabled.Proposed change
PJ_VERSIONto2.17inscripts/fetch-pjproject.sh(thePJ_URLtemplate already interpolates the version).build.rsauto-detection pathcrates/pjsip-shim/vendor/pjproject-2.17still resolves (it derives fromPJ_VERSION, so it should).pjsip-shim-cffiCI job validate the build against 2.17.Notes
Vendored sources are git-ignored (GPL-2.0), so this is a one-line default bump plus a CI re-run to confirm the shim still compiles and links against the 2.17 headers/sources. Low risk; no Rust code changes expected.
Found during deep-QA upstream-currency review (FINDINGS.md, task #5).